86b0584621ca1b260f655a71e1b492f34cb64d10e4d2252135de7f8c847d8504.zip
- SHA256 86b0584621ca1b260f655a71e1b492f34cb64d10e4d2252135de7f8c847d8504
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
avastsvc/AvastSvc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
avastsvc/AvastSvc.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
avastsvc/wsc.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
avastsvc/wsc.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 86b0584621ca1b260f655a71e1b492f34cb64d10e4d2252135de7f8c847d8504.zip
- Size 168KB
- Sample260317-c8ec1ads6v
- SHA256 86b0584621ca1b260f655a71e1b492f34cb64d10e4d2252135de7f8c847d8504
- MD5 c87c0d192740d1b9dfdfe8b4679f5055
- SHA1 e3962f4d84ad6e2e8a21a0678c718779fbbeacd0
- SHA512 24f7c7a06de7bd436b840c5d3109a4e50666b4104e6f09e014dcd99e490e04f4babed48391820e6c1f73a05d47d232b163a2b60c84ee3a1da9bfc4c5ec390264
- SSDEEP 3072:TmAqpZgih+vBdovxzLDcwNYpOyqlOXXIQ9A4HKNIm5+FdfDYSr:6XE/qdLgQlpcX44HHsz+FJDt
- TLSH T10DF312CD23F57BC9E1F9D9F249F79D357D2A252048620DBBD70DE488CD96A10022AF98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/avastsvc/wsc.dll - Untrusted Codesign Signers 1 IoCs
Codesigned binary was signed by an untrusted entity.
resource unpack001/avastsvc/AvastSvc.exe
File Explorer
-
86b0584621ca1b260f655a71e1b492f34cb64d10e4d2252135de7f8c847d8504.zip.zip 168KB
-
avastsvc/AvastAuth.dat162KB
-
avastsvc/AvastSvc.exe.exe 60KB
-
avastsvc/wsc.dll.dll 80KB
avastsvc/AvastAuth.dat
- SHA256 432a07eb49473fa8c71d50ccaf2bc980b692d458ec4aaedd52d739cb377f3428
- MD5 ebb7749069a9b5bcda98d89f04d889db
- SHA1 c4ac1c5f4d3faa00ab846dceca67df3a51ad158b
- SHA512 a0f75d7aea95d157d6674adbc454f672dd356c75901dfcd8a8defa78d0dc087ae4c092636428f46f613d232d25dd3eb1c00d1e1e2e69b30b3b23bd14532b91e9
- SSDEEP 3072:v81Nn8kZFCwbXoW4FE//us5nzf/U7ZYJoZJEvR4eV2f/IS2C+vGs4HMRc/a85vHH:8ZFf/mZ7uoZW1hC+x/u/1VnvseNW48Xg
- TLSH T167F3AFCAE747241C37ACF0F75D58BC55AFE118A1ADEFADD8E22D53A14CC73861228642
- MD5 SHA1 SHA512 SSDEEP TLSH
avastsvc/AvastSvc.exe
- IMPHASH f1cc6c4c6182edcc39d0ba2695016c63
- SHA256 85ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654
- MD5 a72036f635cecf0dcb1e9c6f49a8fa5b
- SHA1 049813b955db1dd90952657ae2bd34250153563e
- SHA512 e3582e0969361d272c2469ce139ec809b9b0ac98fbc5eb5bb287442aed4c6ba69ed8175b68970751c93730cfaf07b75c3bc5e4e24aeda8f984b24f33bb8e3da2
- SSDEEP 768:Q/WQ3/TymxfsHYPry0bgYh3LKgMoCDGFh9D:Q+QvT7xUHYPDbgYVLWofD
- TLSH T1545392129E001505D8AA0F30E0ADBA1E16237FFA1674825B3E39FC9DFE6D77B2850B54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
13:49:1d:37:81:1f:37:89:11:c6:78:41:56:47:bd:0e:0f:fc:90:87:79:ad:e8:e4:03:43:b8:25:a1:15:50:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Chains
Mar 13, 2026
PE Signature issue
Digest
55:6b:7c:09:f8:8f:1b:e0:bf:1c:75:a6:e4:ab:fd:31:0f:4c:76:f8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Chains
Mar 28, 2017
Subject
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Serial Number
07:c7:0f:7c:ab:14:5b:c1:ed:38:5f:be:69:fa:31:30
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2016 - Oct 4, 2019
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Serial Number
04:a4:28:af:3c:af:38:44:74:6a:c6:3e:2e:09:fa:a1
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 29, 2014 - Jun 2, 2017
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Workspace\workspace\ProductionClients-ForRelease\AVBranding\avast\CONFIG\Release\label_exp\WinClient\BUILDS\Release\x86\wsc_proxy.pdb
kernel32
GetLastError
LoadLibraryW
GetProcAddress
ExitProcess
FreeLibrary
GetCommandLineW
Name
.text
Size
512B
Virtual Size
90B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
742B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=1, productName=Unmarked objects,
count=1, id=265, version=24213,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,
avastsvc/wsc.dll
- IMPHASH f35c12020aec2c05dac4812ec3be62d4
- SHA256 e8f55d0f327fd1d5f26428b890ef7fe878e135d494acda24ef01c695a2e9136d
- MD5 722b15bbc15845e4e265a1519c800c34
- SHA1 56bac516227d9fddc08ca586dba5c9085d203f99
- SHA512 a925614f3e89e37198d875670b3844449d6ab77728d53c1a06a5db035b7117a0b61cd8ada0022b6b5e0e8d6fad9417561a82cdbb5b288273c60b1469816a9d0d
- SSDEEP 1536:HEI2BTzyutxs8TLWyEL59s6TaIret4R27t2Wfu63y:H+WTLHI4RQt2Wfri
- TLSH T1E9837D6136D1C1B2C84E427A9555CB11637A3522CEFA4483BFEB4B8DAF912E0773F281
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13732
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
ReadFile
CreateFileA
GetProcAddress
GetModuleHandleA
LocalAlloc
lstrcatA
ExitProcess
FreeLibrary
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
RtlUnwind
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetLocaleInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
_run@4
afqsisambtbcqlokdmjcicvhkmacmyskthcrvcfpfgdxjyypk
fggrcqaonkufmcjsqrdgrrkbidomminmwabwbcerox
gmepnmhkysgyg
oriphpnyfhvjphereotxjijlcpmshpfdhkebxy
ugk
uspkmoqdkldgvjkqbwsnajsayvtcxxownymkr
vwfsivelhgsvrnevmnuunbjrstp
xuxlwqbanylwxwwjutqxuvalny
Name
.text
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=90, id=1, productName=Unmarked objects,
count=19, id=125, productName=VS2005 build 50727, version=50727,
count=99, id=109, productName=VS2005 build 50727, version=50727,
count=38, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,